syzbot


possible deadlock in hfs_find_init

Status: upstream: reported C repro on 2023/03/22 23:14
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+5ec6d29e9352c6f10dc7@syzkaller.appspotmail.com
First crash: 784d, last: 3d07h
Fix bisection: failed (error log, bisect log)
  
Bug presence (1)
Date Name Commit Repro Result
2024/04/24 upstream (ToT) e88c4cfcb7b8 C [report] possible deadlock in hfs_find_init
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 possible deadlock in hfs_find_init hfs C 1 807d 839d 0/1 upstream: reported C repro on 2023/01/26 19:14
linux-4.19 possible deadlock in hfs_find_init hfs C error 7 801d 867d 0/1 upstream: reported C repro on 2022/12/30 06:08
upstream possible deadlock in hfs_find_init (2) hfs C error 3597 5h28m 870d 0/28 upstream: reported C repro on 2022/12/27 00:59
linux-6.1 possible deadlock in hfs_find_init origin:upstream C 155 18d 786d 0/3 upstream: reported C repro on 2023/03/20 17:38
upstream possible deadlock in hfs_find_init hfs C done error 1 1588d 2579d 20/28 fixed on 2021/11/10 00:50

Sample crash report:
loop0: detected capacity change from 0 to 64
======================================================
WARNING: possible circular locking dependency detected
5.15.178-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor158/4795 is trying to acquire lock:
ffff88807807e0b0 (&tree->tree_lock/1){+.+.}-{3:3}, at: hfs_find_init+0x16a/0x1e0

but task is already holding lock:
ffff8880766bcef8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{3:3}, at: hfs_extend_file+0xfb/0x1440 fs/hfs/extent.c:397

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{3:3}:
       lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
       __mutex_lock_common+0x1da/0x25a0 kernel/locking/mutex.c:596
       __mutex_lock kernel/locking/mutex.c:729 [inline]
       mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
       hfs_extend_file+0xfb/0x1440 fs/hfs/extent.c:397
       hfs_bmap_reserve+0xd5/0x3f0 fs/hfs/btree.c:231
       __hfs_ext_write_extent+0x22e/0x4f0 fs/hfs/extent.c:121
       hfs_ext_write_extent+0x150/0x1d0 fs/hfs/extent.c:144
       hfs_write_inode+0xb8/0xec0 fs/hfs/inode.c:432
       write_inode fs/fs-writeback.c:1495 [inline]
       __writeback_single_inode+0x644/0xe30 fs/fs-writeback.c:1705
       writeback_sb_inodes+0xbce/0x1a40 fs/fs-writeback.c:1930
       wb_writeback+0x451/0xc50 fs/fs-writeback.c:2104
       wb_do_writeback fs/fs-writeback.c:2247 [inline]
       wb_workfn+0x46c/0x1130 fs/fs-writeback.c:2288
       process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
       worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
       kthread+0x3f6/0x4f0 kernel/kthread.c:334
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

-> #0 (&tree->tree_lock/1){+.+.}-{3:3}:
       check_prev_add kernel/locking/lockdep.c:3053 [inline]
       check_prevs_add kernel/locking/lockdep.c:3172 [inline]
       validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
       __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
       lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
       __mutex_lock_common+0x1da/0x25a0 kernel/locking/mutex.c:596
       __mutex_lock kernel/locking/mutex.c:729 [inline]
       mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
       hfs_find_init+0x16a/0x1e0
       hfs_ext_read_extent fs/hfs/extent.c:200 [inline]
       hfs_extend_file+0x317/0x1440 fs/hfs/extent.c:401
       hfs_bmap_reserve+0xd5/0x3f0 fs/hfs/btree.c:231
       hfs_cat_create+0x1e7/0xa60 fs/hfs/catalog.c:104
       hfs_create+0x62/0xd0 fs/hfs/dir.c:202
       lookup_open fs/namei.c:3462 [inline]
       open_last_lookups fs/namei.c:3532 [inline]
       path_openat+0x130a/0x2f20 fs/namei.c:3739
       do_filp_open+0x21c/0x460 fs/namei.c:3769
       do_sys_openat2+0x13b/0x4f0 fs/open.c:1253
       do_sys_open fs/open.c:1269 [inline]
       __do_sys_openat fs/open.c:1285 [inline]
       __se_sys_openat fs/open.c:1280 [inline]
       __x64_sys_openat+0x243/0x290 fs/open.c:1280
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x66/0xd0

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&HFS_I(tree->inode)->extents_lock);
                               lock(&tree->tree_lock/1);
                               lock(&HFS_I(tree->inode)->extents_lock);
  lock(&tree->tree_lock/1);

 *** DEADLOCK ***

4 locks held by syz-executor158/4795:
 #0: ffff88807807c460 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x3b/0x80 fs/namespace.c:377
 #1: ffff8880766bca28 (&type->i_mutex_dir_key#6){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:789 [inline]
 #1: ffff8880766bca28 (&type->i_mutex_dir_key#6){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3529 [inline]
 #1: ffff8880766bca28 (&type->i_mutex_dir_key#6){+.+.}-{3:3}, at: path_openat+0x824/0x2f20 fs/namei.c:3739
 #2: ffff8880785840b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfs_find_init+0x16a/0x1e0
 #3: ffff8880766bcef8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{3:3}, at: hfs_extend_file+0xfb/0x1440 fs/hfs/extent.c:397

stack backtrace:
CPU: 1 PID: 4795 Comm: syz-executor158 Not tainted 5.15.178-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 check_noncircular+0x2f8/0x3b0 kernel/locking/lockdep.c:2133
 check_prev_add kernel/locking/lockdep.c:3053 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain+0x1649/0x5930 kernel/locking/lockdep.c:3788
 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
 __mutex_lock_common+0x1da/0x25a0 kernel/locking/mutex.c:596
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 hfs_find_init+0x16a/0x1e0
 hfs_ext_read_extent fs/hfs/extent.c:200 [inline]
 hfs_extend_file+0x317/0x1440 fs/hfs/extent.c:401
 hfs_bmap_reserve+0xd5/0x3f0 fs/hfs/btree.c:231
 hfs_cat_create+0x1e7/0xa60 fs/hfs/catalog.c:104
 hfs_create+0x62/0xd0 fs/hfs/dir.c:202
 lookup_open fs/namei.c:3462 [inline]
 open_last_lookups fs/namei.c:3532 [inline]
 path_openat+0x130a/0x2f20 fs/namei.c:3739
 do_filp_open+0x21c/0x460 fs/namei.c:3769
 do_sys_openat2+0x13b/0x4f0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1280
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f2fb70e9bc9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2fb70a5168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f2fb71726c8 RCX: 00007f2fb70e9bc9
RDX: 000000000000275a RSI: 0000400000000000 RDI: 00000000ffffff9c
RBP: 00007f2fb71726c0 R08: 00007f2fb71726c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2fb71726cc
R13: 0000000000000016 R14: 00007ffc5cbf62e0 R15: 00007ffc5cbf63c8
 </TASK>
hfs: request for non-existent node 16777216 in B*Tree
hfs: request for non-existent node 16777216 in B*Tree
hfs: inconsistency in B*Tree (5,0,1,0,1)

Crashes (137):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/23 22:00 linux-5.15.y c16c81c81336 d34966d1 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro #1] [mounted in repro #2] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2024/12/30 04:22 linux-5.15.y 91786f140358 d3ccff63 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2024/04/09 10:28 linux-5.15.y 9465fef4ae35 f3234354 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2024/06/12 05:04 linux-5.15.y c61bd26ae81a 4d75f4f7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2023/06/17 03:50 linux-5.15.y 471e639e59d1 f3921d4d .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2023/07/23 02:21 linux-5.15.y d54cfc420586 27cbe77f .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/05/11 17:42 linux-5.15.y 3b8db0e4f263 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/04/23 08:16 linux-5.15.y f7347f400572 53a8b9bd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/04/22 02:06 linux-5.15.y f7347f400572 2a20f901 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/03/10 14:53 linux-5.15.y c16c81c81336 16256247 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/02/01 13:00 linux-5.15.y 003148680b79 aa47157c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/01/19 05:34 linux-5.15.y 4735586da88e f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/01/13 09:26 linux-5.15.y 4735586da88e 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/01/08 11:10 linux-5.15.y 91786f140358 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/01/07 12:05 linux-5.15.y 91786f140358 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/01/02 16:44 linux-5.15.y 91786f140358 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2024/12/31 11:59 linux-5.15.y 91786f140358 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2024/12/30 03:27 linux-5.15.y 91786f140358 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2024/12/25 21:42 linux-5.15.y 91786f140358 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2024/12/02 06:27 linux-5.15.y 0a51d2d4527b 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2024/11/15 19:20 linux-5.15.y d98fd109f827 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan possible deadlock in hfs_find_init
2025/05/12 01:29 linux-5.15.y 3b8db0e4f263 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/05/10 21:40 linux-5.15.y 3b8db0e4f263 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/05/10 14:49 linux-5.15.y 3b8db0e4f263 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/05/05 07:43 linux-5.15.y 16fdf2c7111b b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/04/21 13:55 linux-5.15.y f7347f400572 2a20f901 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/04/13 22:19 linux-5.15.y f7347f400572 0bd6db41 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/04/11 05:33 linux-5.15.y f7347f400572 94486846 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/04/08 10:05 linux-5.15.y 0c935c049b5c a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/04/08 10:05 linux-5.15.y 0c935c049b5c a775275d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/04/01 02:48 linux-5.15.y 0c935c049b5c 36d76a97 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/03/26 22:28 linux-5.15.y 0c935c049b5c 20510e88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/03/18 10:44 linux-5.15.y 0c935c049b5c ce3352cd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/03/14 14:50 linux-5.15.y 0c935c049b5c e2826670 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/02/27 13:58 linux-5.15.y c16c81c81336 6a8fcbc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/02/09 23:58 linux-5.15.y c16c81c81336 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/02/08 10:50 linux-5.15.y c16c81c81336 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/02/04 17:02 linux-5.15.y c16c81c81336 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/02/04 05:33 linux-5.15.y c16c81c81336 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/01/18 23:41 linux-5.15.y 4735586da88e f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/01/14 03:12 linux-5.15.y 4735586da88e b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/01/09 20:38 linux-5.15.y 4735586da88e 9220929f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2025/01/05 20:15 linux-5.15.y 91786f140358 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/12/19 19:38 linux-5.15.y 91786f140358 5905cb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/12/19 18:03 linux-5.15.y 963e654022cc 5905cb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/12/08 00:07 linux-5.15.y 0a51d2d4527b 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/12/06 12:53 linux-5.15.y 0a51d2d4527b 946d28f0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/12/04 23:07 linux-5.15.y 0a51d2d4527b b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/29 13:56 linux-5.15.y 0a51d2d4527b 5df23865 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/29 08:05 linux-5.15.y 0a51d2d4527b 5df23865 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/22 08:57 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/21 17:59 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/18 22:50 linux-5.15.y 0a51d2d4527b e7bb5d6e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/16 14:17 linux-5.15.y d98fd109f827 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/16 00:37 linux-5.15.y d98fd109f827 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/10 22:20 linux-5.15.y 3c17fc483905 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/09 22:36 linux-5.15.y 3c17fc483905 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/09 13:19 linux-5.15.y 3c17fc483905 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2024/11/02 23:09 linux-5.15.y 72244eab0dad f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
2023/03/22 23:13 linux-5.15.y 115472395b0a f94b4a29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 possible deadlock in hfs_find_init
* Struck through repros no longer work on HEAD.